如何使用pip-audit扫描Python包中的安全漏洞

关于pip-audit

pip-audit是何使一款功能强大的安全漏洞扫描工具，该工具主要针对Python环境，安全可以帮助广大研究人员扫描和测试Python包中的漏洞已知安全漏洞。pip-audit使用了PythonPackagingAdvisory数据库和PyPIJSONAPI作为漏洞报告源。何使

功能介绍

支持对本地环境和依赖组件(requirements风格文件)进行安全审计;支持多种漏洞服务(PyPI、安全OSV);支持以CycloneDX XML或JSON格式发送SBOM;提供人类和机器均可读的漏洞输出格式(columnar、源码下载JSON);无缝接入 / 重用本地pip缓存;

工具安装

pip-audit基于Python开发，何使且要求本地环境为Python 3.7或更新版本。安全安装并配置好Python环境之后，漏洞就可以使用下列命令并通过pip来安装pip-audit了：

复制python -m pip install pip-audit1. 第三方包

pip-audit的何使正常运行需要使用到多个第三方包，具体组件包名称和版本如下图所示：

除此之外，安全我们还可以通过conda来安装pip-audit：

复制conda install -c conda-forge pip-audit1. 工具使用

我们可以直接将pip-audit以独立程序运行，漏洞或通过"python -m"运行：

复制pip-audit --helppython -m pip_audit --help1.2.3. 复制usage: pip-audit [-h] [-V] [-l] [-r REQUIREMENTS] [-f FORMAT] [-s SERVICE

]

[-d] [-S] [--desc [{on,何使off,auto}]] [--cache-dir CACHE_DIR

]

[--progress-spinner {on,off}] [--timeout TIMEOUT

]

[--path PATHS] [-v] [--fix] [--require-hashes

]

audit the Python environment for dependencies with known vulnerabilitiesoptional arguments

:

-h, --help show this help message and exit -V, --version show programs version number and exit -l, --local show only results for dependencies in the local environment (default: False

)

-r REQUIREMENTS, --requirement REQUIREMENTS audit the given requirements file; this option can be used multiple times (default: None

)

-f FORMAT, --format FORMAT the format to emit audit results in (choices: columns

,

json, cyclonedx-json, cyclonedx-xml) (default

:

columns

)

-s SERVICE, --vulnerability-service SERVICE the vulnerability service to audit dependencies against (choices: osv, pypi) (default: pypi

)

-d, --dry-run without `--fix`: collect all dependencies but do not perform the auditing step; with `--fix`: perform the auditing step but do not perform any fixes (default

:

False

)

-S, --strict fail the entire audit if dependency collection fails on any dependency (default: False

)

--desc [{on,off,auto

}]

include a description for each vulnerability; `auto` defaults to `on` for the `json` format. This flag has no effect on the `cyclonedx-json` or `cyclonedx-xml` formats. (default: auto

)

--cache-dir CACHE_DIR the directory to use as an HTTP cache for PyPI; uses the `pip` HTTP cache by default (default: None

)

--progress-spinner {on,off

}

display a progress spinner (default: on

)

--timeout TIMEOUT set the socket timeout (default: 15

)

--path PATHS restrict to the specified installation path for auditing packages; this option can be used multiple times (default

: [])

-v, --verbose give more output; this setting overrides the `PIP_AUDIT_LOGLEVEL` variable and is equivalent to setting it to `debug` (default: False

)

--fix automatically upgrade dependencies with known vulnerabilities (default: False

)

--require-hashes require a hash to check each requirement against, for repeatable audits; this option is implied when any package in a requirements file has a `--hash` option

.

(default: False)1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.35.36.37.38.39.40.41.42.43.44.45.46.47.48.49.50.51.52.53.54.55.56.57.58.59.60.61.62.63.64.65.66.67.68.69.70.71.72.73.74.75.76.77.78.79.80.81.82.83.84.85.86.87.88.89.90.91.92.93.94.95.96.97.98.99.100.101. 退出代码

任务完成后， pip-audit将会退出运行，企商汇安全并返回一个代码以显示其状态，漏洞其中：

0：未检测到已知漏洞;1：检测到了一个或多个已知漏洞;工具使用样例

审计当前Python环境中的依赖：

复制$ pip-auditNo known vulnerabilities found1.2.3.

$ pip-audit No known vulnerabilities found审计给定requirements文件的依赖：

复制$ pip-audit -r ./requirements.txtNo known vulnerabilities found1.2.3.

审计一个requirements文件，并排除系统包：

复制$ pip-audit -r ./requirements.txt -lNo known vulnerabilities found1.2.3.

审计依赖中发现的安全漏洞：

复制$ pip-auditFound 2 known vulnerabilities in 1 packageName Version ID Fix Versions---- ------- -------------- ------------Flask 0.5 PYSEC-2019-179 1.0Flask 0.5 PYSEC-2018-66 0.12.31.2.3.4.5.6.7.8.9.10.11.

审计依赖(包含描述)：

复制$ pip-audit --descFound 2 known vulnerabilities in 1 packageName Version ID Fix Versions Description---- ------- -------------- ------------ --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Flask 0.5 PYSEC-2019-179 1.0 The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656.Flask 0.5 PYSEC-2018-66 0.12.3 The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083.1.2.3.4.5.6.7.8.9.10.11.

审计JSON格式依赖：

复制$ pip-audit -f json | jqFound 2 known vulnerabilities in 1 package

[

{

"name": "flask"

,

"version": "0.5"

,

"vulns"

: [

{

"id": "PYSEC-2019-179"

,

"fix_versions"

: [

"1.0"

],

"description": "The Pallets Project Flask before 1.0 is affected by: unexpected memory usage. The impact is: denial of service. The attack vector is: crafted encoded JSON data. The fixed version is: 1. NOTE: this may overlap CVE-2018-1000656."

},

{

"id": "PYSEC-2018-66"

,

"fix_versions"

: [

"0.12.3"

],

"description": "The Pallets Project flask version Before 0.12.3 contains a CWE-20: Improper Input Validation vulnerability in flask that can result in Large amount of memory usage possibly leading to denial of service. This attack appear to be exploitable via Attacker provides JSON data in incorrect encoding. This vulnerability appears to have been fixed in 0.12.3. NOTE: this may overlap CVE-2019-1010083."

}

]

},

{

"name": "jinja2"

,

"version": "3.0.2"

,

"vulns"

: []

},

{

"name": "pip"

,

"version": "21.3.1"

,

"vulns"

: []

},

{

"name": "setuptools"

,

"version": "57.4.0"

,

"vulns"

: []

},

{

"name": "werkzeug"

,

"version": "2.0.2"

,

"vulns"

: []

},

{

"name": "markupsafe"

,

"version": "2.0.1"

,

"vulns"

: []

}

]

1.2.3.4.5.6.7.8.9.10.11.12.13.14.15.16.17.18.19.20.21.22.23.24.25.26.27.28.29.30.31.32.33.34.35.36.37.38.39.40.41.42.43.44.45.46.47.48.49.50.51.52.53.54.55.56.57.58.59.60.61.62.63.64.65.66.67.68.69.70.71.72.73.74.75.76.77.78.79.80.81.82.83.84.85.86.87.88.89.90.91.92.93.94.95.96.97.

审计并尝试自动审计存在漏洞的依赖：

复制$ pip-audit --fixFound 2 known vulnerabilities in 1 package and fixed 2 vulnerabilities in 1 packageName Version ID Fix Versions Applied Fix----- ------- -------------- ------------ ----------------------------------------flask 0.5 PYSEC-2019-179 1.0 Successfully upgraded flask (0.5 => 1.0

)

flask 0.5 PYSEC-2018-66 0.12.3 Successfully upgraded flask (0.5 => 1.0)1.2.3.4.5.6.7.8.9.10.11.

许可证协议

本项目的开发与发布遵循 Apache 2.0开源许可证协议。

项目地址

点审核：【​​GitHub传送门​​】

香港云服务器

本文地址：http://www.bzuk.cn/news/176e6999754.html